From: Church, Chuck (cchurch@netcogov.com)
Date: Thu Oct 14 2004 - 16:03:52 GMT-3
It's not a bug. I believe it had something to do with the fact that a
router doesn't keep the running config in memory to show when needed.
When you do a 'sh run', it actually parses through all the various
interface, router, etc data structures, and builds it. This behind the
scenes work seems to require level 15 access itself. I don't remember
if there was a work around or not. Maybe someone on the list will
remember the fix, if it exists...
Chuck Church
Lead Design Engineer
CCIE #8776, MCNE, MCSE
Netco Government Services - Design & Implementation
1210 N. Parker Rd.
Greenville, SC 29609
Home office: 864-335-9473
Cell: 703-819-3495
cchurch@netcogov.com
PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4371A48D
-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of
JD Plant
Sent: Thursday, October 14, 2004 2:17 PM
To: CCIE Security Mailing List
Subject: Command Authorization for show run
Hey all,
I have noticed strange behavior every time i've used command
authorization to allow the show run command. Everything works great
with all the other commands at the same level.
The commands are configured properly for the per user command
authorization.
The show run command even executes successfully. The problem is the
output is empty, nothing but exclamation marks. I don't know if this
is a bug in command auth or what. Config and command output below:
R7#show run
Building configuration...
Current configuration : 13 bytes
!
!
!
!
end
R7#
**CONFIGURATION SNIPPET***
aaa new-model
aaa authentication login vty group tacacs+ local
aaa authorization exec vty group tacacs+ local
aaa authorization commands 1 vty group tacacs+ if-authenticated
aaa authorization commands 5 vty group tacacs+ if-authenticated
aaa accounting exec vty start-stop group tacacs
aaa accounting commands 1 vty start-stop group tacacs
aaa accounting commands 5 vty start-stop group tacacs
tacacs-server host 175.1.2.3 key cisco
user lab7-telnet privilege 5 password cisco
line vty 0 4
login authentication vty
authori exec vty
authorization commands 1 vty
authorization commands 5 vty
accounting exec vty
accounting commands 1 vty
accounting commands 5 vty
privilege exec level 5 show running-config
privilege exec level 5 ping
This archive was generated by hypermail 2.1.4 : Sat Nov 06 2004 - 17:11:48 GMT-3